# T04 — Webhook receivers

**Threat model.** An attacker who can POST to the application, but does not
hold the provider's signing secret, tries to forge a payment or membership
event.

**Slice.** `internal/integrations/stripe/web/webhook.go`,
`internal/integrations/discourse/web/webhook.go`, and the fulfillment code each
one reaches (`internal/fulfillment/`, the outbox/event tables they write).

**Questions.**
1. Is the signature verified before any part of the payload is parsed, trusted,
   logged, or written? Show the order.
2. On verification failure, what status is returned and is anything persisted?
3. Is the comparison constant-time? Is the secret loaded per-request or cached,
   and what happens if it is empty or unset?
4. Replay: can the same signed event be delivered twice, and what is the
   effect? Is there an idempotency key, a timestamp tolerance, or neither?
5. Does the handler trust amounts, identifiers, or plan references from the
   payload, or refetch authoritative state from the provider?
6. If a delivery fails mid-processing, can it leave a person entitled to
   something unpaid, or paid but unentitled?

**Not in scope.** Whether the paths are exempt (T03 covers that).